Advanced Windows PowerShell Scripting Video Training

Tuesday, May 31, 2011

Below is a working PowerShell function that will help you enable/disable Deletion Protection on organizational units, user and group objects. I included online help in this one so just dot source it or put it in a module to use it. Once loaded, just type Get-Help Set-Deletion Protection –Full to see the entire help file and examples on how to use it.

There are actually two functions here. The first supports the second.

<#

.SYNOPSIS

Confirms if a module is available.

.DESCRIPTION

Confirms if the provided parameter is available on

the local client.

.PARAMETER ModuleName

The name of the module who’s presence is being checked.

.EXAMPLE

Confirm-Module ActiveDirectory

Checks to see if the ActiveDirectory module is

present on the local machine

Returns True is present and False if not.

.OUTPUTS

Boolean

.Link

Get-Module

#>

FunctionConfirm-Module

{

Param ($ModuleName= $(Throw"You need to provide a module name."))

# Place the name of the module from Get-Module into

# the variable $Data

$Data= (Get-Module-ListAvailable-Name$ModuleName).name

# If the contents of $Data is equal to the variable

# $ModuleName, the module is present, return

# True. If not, return $False.

If ($Data-eq$ModuleName){Return$True}

Else {Return$False}

}

<#

.SYNOPSIS

Ensures that Deletion Protection is set on AD Objects

.DESCRIPTION

Allows you to set the Deletion Protection on specific classes of objects in an Active Directory Environment.

This allows you to set Deletion Protection on both User and Group objects that otherwise do not have this capability in the Set-ADUser and Set-ADGroup cmdlets.

.PARAMETER Enabled

Sets whether to enable or disable Deletion Protection on the specified object classes. This value must be set as $True or $False.

.PARAMETER OU

Targets the Organizational Units objects in Active Directory.

.PARAMETER Group

Targets the group objects in Active Directory.

.PARAMETER User

Targets the user objects in Active Directory.

.PARAMETER Root

The name of the OU or Container to use as the root for processing the cmdlet . By default, all objects in the domain are processed for the object classes specified.

.EXAMPLE

Set-DeletionProtection $True -OU

Protects all Organization Units in the domain from accidental deletion.

.EXAMPLE

Set-DeletionProtection $True -User -Group

Protects all User and Group objects in the domain from accidental deletion.

.EXAMPLE

Set-DeletionProtection $False -User -Root "IT Managers"

Removes Deletion Protection for all Users in the OU or Container whos' distinguished name contains "IT Managers"

.EXAMPLE

Set-DeletionProtection $False -User -Root "IT"

---------------------------------------------

The following OUs or Containers matched your Root parameter: IT. Please select the index number of the OU or Container that you want to execute this cmdlet against.

Index DistinguishedName

----- -----------------

0 CN=ForeignSecurityPrincipals,DC=Contoso,DC=com

1 CN=IP Security,CN=System,DC=Contoso,DC=com

2 CN=ComPartitions,CN=System,DC=Contoso,DC=com

3 CN=ComPartitionSets,CN=System,DC=Contoso,DC=com

4 OU=IT,DC=Contoso,DC=com

5 OU=IT Test,OU=IT,DC=Contoso,DC=com

Index number:

In the above example, the cmdlet is attempting to remove deletion protection from all User Objects that is in an OU or Container that contains "IT" in the Distinguished Name. The problem is that multiple OUs or Containers contain "IT" in them. The menu presented above to the user will allow the user to choose the index number of the OU or Container to execute the cmdlet against.

.EXAMPLE

Set-Deletionprotection $True -OU -Root "OfficeStaff"

---------------------------------------------

No OU or Container matched your query.

The Cmdlet is terminating with no changes made.

The cmdlet above is attempting to enable Deletion Protection on all OUs or Containers with the name "OfficeStaff" in the Distinguished Name. In this case, no OU or Container in the domain has the string "OfficeStaff: in it.

.NOTES

The Active Directory Module for PowerShell must be Available

Active Directory Users and Computers will be non- responsive while this cmdlet runs.

Monday, May 30, 2011

In class I miss quoted Microsoft. In Microsoft’s’ documentation, the actual wording is “the initial size of the .vhd file is only about 3 MB.” So I created 4 dynamically expanding VHD files. Their maximum sizes are 1GB, 10GB, 100GB, and 2TB. Below is a screen shot of their initial sizes:

Saturday, May 28, 2011

The VLAN ID feature in Hyper-V allows you to support 802.1Q standards for VLAN Tagging. In short, it allows you to isolate hosts on the same physical network.

In the Hyper-V world, we can utilize VLAN IDs in two ways. We can isolate certain computers on the network or we can isolate VMs inside our hosts. First and foremost, your routers need to support and be configured with the VLAN identifiers. For the External and Internal virtual network configurations, you can isolate traffic to and from your host using a VLAN ID. You can do this for management purposes. As a result, only data tagged for the host VLAN will make it to your VMs. The other method is to configure the NICs of the VMs with a VLAN ID themselves. This is available in all three virtual network profiles. When used with the External profile, your VMs will only be able to communicate with VMs and physical host on your network with a matching VLAN ID.

Friday, May 27, 2011

Yes it will. In class we assigned a delegation to a GPO and then backed it up by right clicking the GPO and selecting Backup. After the backup completed I removed the delegation. I then right clicked the GPO and selected Restore. Once the restore completed, the permissions for the GPO were all back.

Thursday, May 26, 2011

One of the things that I’ve noticed in the PowerShell cmdlets are parameters without values. These switches alter the way that the cmdlet functions without providing any input. This is the switch parameter functionality. Here is how it works.

When you declare a parameter as a switch parameter, its value is set to $False. Using what ever logic you like, you can test to see if the condition became $True. That means the user executed the function and specified the switch. Let’s look at a simple example:

In the function Test1, we have two values, a number and the switch parameter called $Add5. This function is simple. You provide it a number and it displays the number. If you add the –Add5 parameter, it adds 5 to the number you provided. Here is an example:

PS C:\Users\Jason> test1 5

5

PS C:\Users\Jason>

In the above example, we executed the script with the value of 5. The result was 5.

PS C:\Users\Jason> test1 5 -Add5

10

PS C:\Users\Jason>

In this example, we included the –Add5 switch parameter. In our code, we stipulated that if this parameter is $True, the we add 5 to the $Value that we gave the function.

The switch parameter functionality is good to use when you need to have a Boolean value as a parameter.

Tuesday, May 24, 2011

Both the domain and forest functional modes in a Windows domain will determine what functionality that you get. When you purchase a new Windows Server OS, it comes with more advanced functionality than the previous version. Some of that functionality may not be compatible with previous versions of the server OS. In order to raise the functional level to say, Windows Server 2008, you need to upgrade all your domain controllers to a minimum of Windows Server 2008. You can still have Windows 2000 and 2003 member servers, just not as domain controllers.

You can use PowerShell to raise both your functional levels. Here is an example of how to raise both levels to Windows Server 2008 R2.